rcf-lite 0.25.0 → 0.27.0

package/blueprints/application-onboarding-tour/contributions/user-stories/application-onboarding-tour-us-26106.json

@@ -13,7 +13,18 @@
       "id": "AC-26106-1",
       "testable": true,
       "scope": "runtime",
-      "description": "The restart-tour control renders on the settings surface as a <button data-action=\"restart-tour\"> reachable via Tab and activatable with Enter; activating it clears the completion state in the applied store (per ADR-2702) and re-opens the tour on the highest-value surface on the next principal load. Covered as part of AC-26104-1's pack check (the check exercises the restart flow end-to-end)."
+      "description": "The restart-tour control renders on the settings surface as a <button data-action=\"restart-tour\"> reachable via Tab and activatable with Enter; activating it clears the completion state in the applied store (per ADR-2702) and re-opens the tour on the highest-value surface on the next principal load. Covered as part of AC-26104-1's pack check (the check exercises the restart flow end-to-end).",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-26106-2",
+      "description": "When the restart-tour control fires but the completion store rejects the clear, the tour does not open and the console log carries data-error=COMPLETION_CLEAR_FAILED with a retry control; the control stays keyboard-reachable.",
+      "given": "the completion store rejects the clear",
+      "when": "a principal fires restart-tour",
+      "then": "the tour does not open, data-error=COMPLETION_CLEAR_FAILED is logged and a retry control renders keyboard-reachable",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
@@ -23,5 +34,5 @@
     "blueprint:application-onboarding-tour"
   ],
   "createdAt": "2026-09-06T23:15:00Z",
-  "updatedAt": "2026-09-06T23:15:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-onboarding-tour/contributions/user-stories/application-onboarding-tour-us-26107.json

@@ -13,7 +13,22 @@
       "id": "AC-26107-1",
       "testable": true,
       "scope": "runtime",
-      "description": "The tooltip carries aria-labelledby pointing at the step heading and aria-describedby pointing at the step body; focus moves into the tooltip on open so the screen reader reads the labelled and described text. Documented as a mechanism-reach gap for the described-text read order because rcf-lite does not drive a real screen reader in CI; the pack asserts the DOM contract and the fixture README names the manual screen-reader smoke."
+      "description": "The tooltip carries aria-labelledby pointing at the step heading and aria-describedby pointing at the step body; focus moves into the tooltip on open so the screen reader reads the labelled and described text. Documented as a mechanism-reach gap for the described-text read order because rcf-lite does not drive a real screen reader in CI; the pack asserts the DOM contract and the fixture README names the manual screen-reader smoke.",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-26107-2",
+      "description": "On close of the tour (Escape, dismiss or last-step confirm), a polite live region announces the outcome (completed or dismissed) so screen-reader users know the state transition happened without inspecting the surface.",
+      "given": "a tour step is open and the principal closes the tour",
+      "when": "the tour closes",
+      "then": "a polite live region announces \"onboarding tour completed\" or \"onboarding tour dismissed\"",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://www.w3.org/TR/WCAG22/#status-messages",
+        "verifiedOn": "2026-09-10"
+      }
     }
   ],
   "tacIds": [
@@ -23,5 +38,5 @@
     "blueprint:application-onboarding-tour"
   ],
   "createdAt": "2026-09-06T23:15:00Z",
-  "updatedAt": "2026-09-06T23:15:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-onboarding-tour/contributions/user-stories/application-onboarding-tour-us-26108.json

@@ -0,0 +1,62 @@
+{
+  "usId": "application-onboarding-tour-US-26108",
+  "prdId": "PRD-001",
+  "reqId": "application-onboarding-tour-REQ-005",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "The elicited dismissal-policy determines whether a version bump re-surfaces the tour",
+  "asA": "principal who dismissed the tour once on a project applying application-onboarding-tour",
+  "iWant": "a subsequent tour version bump to re-surface the tour only if the elicited policy says so",
+  "soThat": "a project's dismissal policy is the policy I actually experience across releases",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-26108-1",
+      "description": "When dismissal-policy is `dismiss-permanently` and the principal dismisses the tour, the completion record marks the dismissal terminal and no version bump re-opens the tour; only the restart-tour control clears the record and re-opens.",
+      "given": "dismissal-policy=dismiss-permanently applied and the principal dismissed the tour once",
+      "when": "the tour version bumps and the principal re-loads",
+      "then": "the tour stays dismissed regardless of the version bump; the restart-tour control clears the record and re-opens the tour",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-26108-2",
+      "description": "When dismissal-policy is `dismiss-until-next-major` the completion store writes the dismissed tour's SemVer, and on principal load compares the stored major segment against the current tour's major segment; the tour re-opens iff the majors differ.",
+      "given": "dismissal-policy=dismiss-until-next-major applied and a completion record from tour v1.4.2",
+      "when": "the tour version changes",
+      "then": "a bump to v1.5.0 does not re-open the tour, a bump to v2.0.0 does re-open it",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-26108-3",
+      "description": "When dismissal-policy is `dismiss-until-next-minor` the completion store writes the dismissed tour's SemVer, and on principal load compares stored and current major.minor; the tour re-opens iff either segment differs.",
+      "given": "dismissal-policy=dismiss-until-next-minor applied and a completion record from tour v1.4.2",
+      "when": "the tour version changes",
+      "then": "a bump to v1.4.9 does not re-open the tour, a bump to v1.5.0 does re-open it and a bump to v2.0.0 does re-open it",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-26108-4",
+      "description": "The completion record shape is owned by `TAC-2703.interfaces.completionStore`; the record shape is identical across the three policies and only the load-time comparison differs. A stored record written under one policy is legal under another (the load-time comparison is what changes).",
+      "given": "a completion record written under any of the three policies",
+      "when": "the applied policy changes at re-apply time",
+      "then": "the record shape is unchanged and the load-time comparison uses the new policy",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-2703-application-onboarding-tour-completion-store",
+        "field": "interfaces.completionStore"
+      }
+    }
+  ],
+  "tacIds": [
+    "TAC-2703-application-onboarding-tour-completion-store"
+  ],
+  "createdAt": "2026-09-10T00:00:00Z",
+  "updatedAt": "2026-09-10T00:00:00Z"
+}

package/blueprints/application-onboarding-tour/contributions/user-stories/application-onboarding-tour-us-26109.json

@@ -0,0 +1,72 @@
+{
+  "usId": "application-onboarding-tour-US-26109",
+  "prdId": "PRD-001",
+  "reqId": "application-onboarding-tour-REQ-006",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "The elicited checklist-anchor mounts the checklist at the resolved slot or a defined fallback",
+  "asA": "operator applying application-onboarding-tour with a chosen checklist-anchor",
+  "iWant": "the checklist to appear in the anchored slot with a defined open state and a defined fallback",
+  "soThat": "the checklist never lands silently in the wrong place or disappears without a reason I can trace",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-26109-1",
+      "description": "When checklist-anchor is `dashboard-top` and application-dashboard is applied, the checklist mounts at the top of the dashboard route as a <details data-role=\"onboarding-tour-checklist\" open> element (open by default per ADR-2703).",
+      "given": "checklist-anchor=dashboard-top with application-dashboard applied",
+      "when": "the dashboard route renders",
+      "then": "the DOM carries a <details data-role=\"onboarding-tour-checklist\" open> element as the first child of the dashboard content region",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "adrId": "ADR-2703-application-onboarding-tour-checklist-anchor",
+        "field": "decision"
+      }
+    },
+    {
+      "id": "AC-26109-2",
+      "description": "When checklist-anchor is `settings-page` and application-account-settings is applied, the checklist mounts on the settings route with the same shape and default open=false.",
+      "given": "checklist-anchor=settings-page with application-account-settings applied",
+      "when": "the settings route renders",
+      "then": "the DOM carries a <details data-role=\"onboarding-tour-checklist\" open=false> element inside the settings content region",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-26109-3",
+      "description": "When checklist-anchor is `custom-anchor` and the elicited CSS selector resolves to a visible, unclipped element on load, the checklist mounts inside that element with open=false and data-role=onboarding-tour-checklist. Applying agent sets: the anchor-selectors elicit's selector string.",
+      "given": "checklist-anchor=custom-anchor with a resolvable, visible selector",
+      "when": "the route with that selector renders",
+      "then": "the DOM carries the <details data-role=\"onboarding-tour-checklist\"> inside the resolved element",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-26109-4",
+      "description": "When checklist-anchor is `custom-anchor` and the selector resolves to nothing, to an invisible element or to a clipped element that cannot fit the checklist, the checklist mounts on the settings route as a fallback and the console log carries data-error=CHECKLIST_ANCHOR_UNRESOLVED naming the selector string. No dialog floats loose over the underlying surface.",
+      "given": "checklist-anchor=custom-anchor with an unresolvable, invisible or clipped selector",
+      "when": "the route renders",
+      "then": "the checklist mounts on the settings route and data-error=CHECKLIST_ANCHOR_UNRESOLVED is logged with the selector; no floating dialog surfaces",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-26109-5",
+      "description": "When no dashboard surface, no settings surface and no usable custom anchor are available, the checklist suppresses entirely (no element is written to the DOM) and the sidecar records checklistSuppressed:true with the reason.",
+      "given": "no dashboard, no settings and no usable custom anchor applied",
+      "when": "any route renders",
+      "then": "no <details data-role=\"onboarding-tour-checklist\"> is present and the sidecar records checklistSuppressed:true",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    }
+  ],
+  "tacIds": [
+    "TAC-2702-application-onboarding-tour-checklist-slot"
+  ],
+  "createdAt": "2026-09-10T00:00:00Z",
+  "updatedAt": "2026-09-10T00:00:00Z"
+}

package/blueprints/application-onboarding-tour/docs/topics.md

@@ -24,7 +24,7 @@ The blueprint claims no new global topics at v1.0.0. Onboarding-tour is a consum
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
@@ -44,8 +44,8 @@ The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authorin
 - `application-spa` (round 1, shipped v1.5.0+): supplies the routing shell (`/tour`, `/dashboard`, `/settings`), the iconography and theming the tour uses. The tour still renders without the SPA blueprint; the project supplies its own routing.
 - `application-dashboard` (round 3, shipped v1.0.0): supplies the dashboard-top anchor slot where the checklist mounts as `<details open>` for returning principals. When absent, the checklist collapses to a `<details>` (closed) on the settings-page anchor (ADR-2703).
 - `application-notifications-in-app` (round 3, shipped v1.0.0): supplies the polite `aria-live` live region the tour-completion announcement uses. When absent, the tour is silent at the announce layer (the step runner still logs one line if a logging companion is present).
-- `application-account-settings` (round 4 T-4, shipped v1.0.0): supplies the settings surface where the restart-tour control lives. When absent, the restart-tour control renders on any settings-shaped surface (`/settings`, `/account`, `/account/settings`).
-- `application-empty-error-states` (round 4 T-1, shipped v1.0.0): the tour composes on the forbidden state when a principal reaches `/tour` without an authenticated session and an auth blueprint is applied. When no auth blueprint is applied, the tour behaves as a single-principal experience per the composition table.
+- `application-account-settings` (round 4, shipped v1.0.0): supplies the settings surface where the restart-tour control lives. When absent, the restart-tour control renders on any settings-shaped surface (`/settings`, `/account`, `/account/settings`).
+- `application-empty-error-states` (round 4, shipped v1.0.0): the tour composes on the forbidden state when a principal reaches `/tour` without an authenticated session and an auth blueprint is applied. When no auth blueprint is applied, the tour behaves as a single-principal experience per the composition table.
 
 ## Probe pack
 

package/blueprints/application-onboarding-tour/guide/application-onboarding-tour.md

@@ -32,7 +32,7 @@ When no persistence blueprint is applied AND the operator does not answer `compl
 - `AC-26105-1` first-run detection: manual verification via the fixture README boot line (open `/tour` twice, confirm the tour auto-opens on run 1 and does not on run 2).
 - `AC-26107-1` screen-reader traversal: the pack asserts the DOM contract; the manual VoiceOver smoke is in the fixture README.
 
-Both gaps ride runner cleanup `w-2026-09-04-dave-020`.
+Both gaps are planned for a follow-up minor runner cleanup.
 
 ## Compose targets
 

package/blueprints/application-onboarding-tour/probe-packs/application-onboarding-tour.pack.mjs

@@ -15,10 +15,10 @@
 //              completion-state store per the elicited shape, activates restart
 //              from the settings surface, asserts the tour re-opens)
 //
-// Every check drives the real Playwright browser the T-0 runner injects and
+// Every check drives the real Playwright browser the runner injects and
 // reads its per-check applicability from the blueprint applied sidecar
 // (rcf/blueprints/application-onboarding-tour.applied.json) written by the apply
-// verb. T-5 has no requiresAppliedCapabilities, but the checklist-slot check
+// verb. The blueprint has no requiresAppliedCapabilities, but the checklist-slot check
 // gates its dashboard-vs-settings branch on the applied-blueprint set
 // (application-dashboard present or not), and the persistence check gates its
 // backend on the elicited completion-state-store answer (with the Q4 fallback

package/blueprints/application-spa/CHANGELOG.md

@@ -0,0 +1,30 @@
+# application-spa CHANGELOG
+
+## 1.5.6 - 2026-09-10
+
+Findings closed: F-3, F-4, F-5, F-6, F-7, F-8, F-9. Template-AC fill-in clauses on AC-1101-1, AC-1102-3, AC-1106-2, AC-1114-1 and AC-1131-3 now enumerate the specific applying-project substitutions (route inventory location, secondary-navigation toggle and breakpoint, semantic-token file and added keys, journey inventory and per-step states, UI-bearing routes and strict-CSP header set) in place of the generic "project-specific bindings, routes, thresholds, budgets, and names" phrasing. Register cleanup on the AC-1131-3 description (partial-acceptance defect described without prior-review internal identifiers) and on README shipped prose (removed prior-review internal identifiers, the numbered ratified-decision reference, and the dated ratified-policy reference).
+
+
+## 1.5.5 - 2026-09-10
+
+Second closure fix on the dimension-d ownership sweep: REQ-009 no longer defines the deep-link return-to behaviour, referencing the owner at `TAC-201-application-spa-app-shell.responsibilities[5]` instead; `deliveredBy.field` re-pointed at `responsibilities[5]` (was generic `responsibilities`). Corrected the 1.5.4 changelog line that recorded the obsolete `responsibilities[0]` ownerRef for AC-1135-2 to `responsibilities[5]`. REQ-009 patch-bumped. Chain-consistency lint zero on pass 1 and pass 2.
+
+## 1.5.4 - 2026-09-10
+
+Dimension-b acceptance-criteria-sufficiency cleanup on US-1134 and US-1135: each story previously shipped a single AC. AC-1134-2 added to bind the icon-adherence probe refusal path on inline-SVG or unknown-alias violations against the primary-navigation slot (ownerRef TAC-208.interfaces.runIconAdherenceProbe). AC-1135-2 added to bind the signed-in and post-sign-out deep-link preservation and return-to flow on the app shell (ownerRef TAC-201.responsibilities[5]). Chain-consistency lint zero on pass 1 and pass 2.
+
+## 1.5.3 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.5.2 (application-core completion pass, 2026-09-09)
+
+- Donor hand-sweep on all 197 ACs: flipped 19 additional ACs from fixed to template where the assertion carries a project-set literal (per-project section inventories, viewport table widths, journey-inventory checkpoints and events, per-route empty-state text, cache-invalidation entry sets, canonical URL shapes cache keys derive from, offline telemetry buffer bound N, per-route payload budgets, external-dependency inventory, deferral-record path and metadata, core-flow definitions, plus the two review-fix-pass flips on AC-1111-5 tablist activation mode and AC-1116-2 journey preservation set). Each flipped AC carries an Applying agent sets: <specific values> clause. Final split: 173 fixed / 24 template.
+- Review fix pass 2026-09-10: F-1 vendorCitation added to AC-1126-4 (WCAG 2.5.8 target-size-minimum) and AC-1126-7 (WCAG 2.2 recommendation); F-2 completion sweep flipped AC-1111-5 and AC-1116-2 to template with Applying agent sets clauses; F-6 internal work-item ids stripped from README v1.2.0 and v1.3.0 changelog paragraphs, from TAC-209 responsibility and tradeoffs, from TAC-210 and TAC-211 purpose, and from AC-1131-3 (the class defect is named without the internal id); F-7 spa guide counts corrected to 76 documents / 35 user stories / 197 acceptance criteria.
+
+## 1.5.1 (application-core hardening, 2026-09-09)
+
+- hardening pass: chain-consistency lint zero (pass1 + pass2); added deliveredBy to every REQ pointing at a TAC responsibility or interface, added ownerRef and disposition to every AC per section 7b, closed case drifts on `content-security-policy` in REQ-018, AC-1125-1 and AC-1131-1 to match the owner spelling on TAC-209.
+- Added AC-1123-6 (telemetry buffer overflow with drop-oldest and drop-count observability on reconnect) covering the 2026-09-08 review finding F-1 on TAC-206.responsibilities[3], and AC-1107-6 (theme persistence failure: visible session-only theme, aria-live unsaved announcement, no persisted preference) covering F-2 on TAC-202.responsibilities[2].
+
+

package/blueprints/application-spa/README.md

@@ -1,6 +1,6 @@
-# application-spa blueprint (v1.3.0)
+# application-spa blueprint (v1.5.6)
 
-The first content blueprint on the rcf-build-lite blueprint mechanism (design brief v2, ratified; Phase 2 of the blueprint programme). Scope: single-page applications with public and authenticated surfaces, session-based auth, single deployable, dark and light by default, fully responsive by default.
+The first content blueprint on the rcf-build-lite blueprint mechanism (design brief v2, ratified). Scope: single-page applications with public and authenticated surfaces, session-based auth, single deployable, dark and light by default, fully responsive by default.
 
 ## Apply
 
@@ -29,9 +29,9 @@ The doc set is contributions (copied into the project tree by `rcf define bluepr
 
 ## What it contributes, and what it deliberately does not
 
-Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (ratified decision 5) and no code.
+Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (a ratified shelf-wide policy) and no code.
 
-No FBS contributions, as a matter of principle (ratified policy 2026-08-19): FBSs are the work of the implementing agent, not the blueprint; project constraints have to be applied at the time of creation. The blueprint contributes the WHAT; the implementing agent derives the HOW-tasks (FBS) in the host project, where the ACs contributed here get picked up by the project's own build sequencing. Structurally the same conclusion falls out of the mechanism: an FBS binds to a bsId and a buildOrder slot the blueprint cannot know.
+No FBS contributions, as a matter of principle (a ratified shelf-wide policy): FBSs are the work of the implementing agent, not the blueprint; project constraints have to be applied at the time of creation. The blueprint contributes the WHAT; the implementing agent derives the HOW-tasks (FBS) in the host project, where the ACs contributed here get picked up by the project's own build sequencing. Structurally the same conclusion falls out of the mechanism: an FBS binds to a bsId and a buildOrder slot the blueprint cannot know.
 
 ## The five global decisions
 
@@ -43,7 +43,7 @@ WCAG 2.2 AA (contrast 4.5:1 body / 3:1 large-and-non-text, visible focus, 24x24
 
 ## What v1.1.0 adds
 
-v1.1.0 is an additive-non-global minor bump. No global topics change; no contribution is removed. The bump introduces the mechanism-reach cure for the icon and semantic-token disciplines that watchpost run4 caught shipping while the build cycle ran green.
+v1.1.0 is an additive-non-global minor bump. No global topics change; no contribution is removed. The bump introduces the mechanism-reach cure for the icon and semantic-token disciplines that a prior review pass caught shipping while the build cycle ran green.
 
 - `application-spa-US-1129` (anchored to application-spa-REQ-005) with four ACs binding the token-adherence probe.
 - `application-spa-US-1130` (anchored to application-spa-REQ-011) with four ACs binding the icon-adherence probe.
@@ -51,11 +51,11 @@ v1.1.0 is an additive-non-global minor bump. No global topics change; no contrib
 - `TAC-208-application-spa-icon-adherence-probe`: a Node build-scan probe the project realises; scans the component source for inline SVG outside the icon registry and for icon references naming aliases the registry does not declare, writes a stable JSON report, and exits non-zero on any violation.
 - `ADR-202-application-spa-theming` and `ADR-206-application-spa-iconography` are amended in place at version 1.1.0: the decision is unchanged; the consequences narrative names the new probe and the delivery-ci-workflows gate-failure path the probe rides.
 
-The v1.1 probes are runtime-observable AC binding at the ship gate. When a project wires each probe as a required gate in the delivery-ci-workflows runner (TAC-701), a violation refuses ship through TAC-702's per-gate report and TAC-703's aggregate report; the run4 pattern of a discipline declared but not compelled no longer applies to these two categories.
+The v1.1 probes are runtime-observable AC binding at the ship gate. When a project wires each probe as a required gate in the delivery-ci-workflows runner (TAC-701), a violation refuses ship through TAC-702's per-gate report and TAC-703's aggregate report; the earlier pattern of a discipline declared but not compelled no longer applies to these two categories.
 
 ## What v1.2.0 adds
 
-v1.2.0 is an additive-non-global minor bump. No global topics change; no contribution is removed. The bump cures the styled-under-shipped-CSP mechanism-reach gap watchpost caught at first production review (w-2026-08-24-003, w-2026-08-24-004): FBS-011 declared strict CSP (`style-src 'self'`, no `'unsafe-inline'`), FBS-013/015 rendered inline `<style>` blocks, every existing UI-bearing gate passed, and every production page rendered unstyled at deploy because the harness bypassed the production security-header path.
+v1.2.0 is an additive-non-global minor bump. No global topics change; no contribution is removed. The bump cures the styled-under-shipped-CSP mechanism-reach gap an early production review caught: FBS-011 declared strict CSP (`style-src 'self'`, no `'unsafe-inline'`), FBS-013/015 rendered inline `<style>` blocks, every existing UI-bearing gate passed, and every production page rendered unstyled at deploy because the harness bypassed the production security-header path.
 
 - `application-spa-US-1131` (anchored to application-spa-REQ-018) with six ACs binding the styled-under-shipped-CSP probe.
 - `TAC-209-application-spa-csp-styled-adherence-probe`: a Node probe the project realises; boots the target server through the production entry-point path, drives a real headless browser at every enumerated UI route, refuses on any inline `<style>` block, any style-src relaxation, any browser-default computed body background, or any non-200 text/css stylesheet response.
@@ -63,7 +63,7 @@ v1.2.0 is an additive-non-global minor bump. No global topics change; no contrib
 
 ## What v1.3.0 adds
 
-v1.3.0 is an additive-non-global minor bump. No global topics change; no contribution is removed. The bump cures the deployment-gate class defect the watchpost first-production review caught (w-2026-08-24-005, class cure w-2026-08-24-006): the app was signed off as DEPLOYED with the only login path (magic-link email) inert because RESEND_API_KEY carried a placeholder value, admin access was reachable only via manually minted tokens, and the gap was filed as a "quirk" note in status.md rather than blocked at gate time. A real key existed in the estate the whole time.
+v1.3.0 is an additive-non-global minor bump. No global topics change; no contribution is removed. The bump cures the deployment-gate class defect an early production review caught: the app was signed off as DEPLOYED with the only login path (magic-link email) inert because RESEND_API_KEY carried a placeholder value, admin access was reachable only via manually minted tokens, and the gap was filed as a "quirk" note in status.md rather than blocked at gate time. A real key existed in the estate the whole time.
 
 The bump encodes three class rules the deployment / handover gates now compel:
 

package/blueprints/application-spa/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "application-spa",
-  "version": "1.5.0",
+  "version": "1.5.6",
   "category": "application",
   "contributions": [
     {

package/blueprints/application-spa/contributions/adrs/adr-201-application-spa-routing.json

@@ -2,7 +2,7 @@
   "adrId": "ADR-201-application-spa-routing",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "accepted",
   "title": "Client-side routing over the History API with a declared route inventory",
   "context": "A single-page application needs one answer to how URLs map to surfaces. Implicit or component-local routing makes deep links, canonical URLs, 404 handling, and telemetry unverifiable. The route model is a whole-project decision: two routing regimes in one deployable produce broken back-button behaviour and unshareable URLs.",

package/blueprints/application-spa/contributions/adrs/adr-202-application-spa-theming.json

@@ -2,7 +2,7 @@
   "adrId": "ADR-202-application-spa-theming",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "status": "accepted",
   "title": "Semantic design tokens as CSS custom properties with a root-level theme switch",
   "context": "Dark and light parity is a ratified requirement (application-spa-REQ-005). Parity is only checkable when every colour decision routes through a named token that exists in both palettes. How theming is realised is a whole-project decision: two theming mechanisms cannot coexist without drift. Watchpost run4 demonstrated that declaring the discipline is not the same as compelling it: raw palette values can sit in component stylesheets across passing build cycles. v1.1 pairs the decision with a runtime-observable enforcement handle so the ship gate refuses on violation, not the operator's later reading of the ADR.",

package/blueprints/application-spa/contributions/adrs/adr-203-application-spa-client-state.json

@@ -2,7 +2,7 @@
   "adrId": "ADR-203-application-spa-client-state",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "accepted",
   "title": "Server-state cache separated from UI state, stale-while-revalidate by default",
   "context": "application-spa-REQ-013 requires a client cache discipline. Whether client state is one store or two regimes is a whole-project decision; mixing regimes per feature produces stale lists, flicker, and phantom optimistic state.",

package/blueprints/application-spa/contributions/adrs/adr-204-application-spa-error-envelope.json

@@ -2,7 +2,7 @@
   "adrId": "ADR-204-application-spa-error-envelope",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "accepted",
   "title": "RFC 7807 problem details as the error shape the client consumes",
   "context": "The client must render errors it can rely on structurally. The wire error shape is a whole-project decision shared with whatever serves the API; this ADR records the client half. A application-api-rest blueprint applied to the same project contributes its own decision on the same topic, and blueprint composition will surface that pairing for the operator to reconcile at add time. That surfacing is intended.",

package/blueprints/application-spa/contributions/adrs/adr-205-application-spa-auth-model.json

@@ -2,7 +2,7 @@
   "adrId": "ADR-205-application-spa-auth-model",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "accepted",
   "title": "Cookie-based session authentication with client-side expiry handling",
   "context": "The blueprint scope is public plus authenticated surfaces with session-based auth. The authentication model is a whole-project decision: the client, the API, and the deploy target must hold the same answer. A application-api-rest blueprint contributes its own decision on this topic; composition surfaces the pairing for operator reconciliation, which is intended.",

package/blueprints/application-spa/contributions/adrs/adr-206-application-spa-iconography.json

@@ -2,7 +2,7 @@
   "adrId": "ADR-206-application-spa-iconography",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "status": "accepted",
   "title": "One icon set behind semantic aliases",
   "context": "application-spa-REQ-011 requires a single icon set. Which construction (stroke width, grid) and how components reference icons needs one recorded answer inside the SPA. Watchpost run4 demonstrated that recording the discipline is not the same as compelling it: a build cycle passed while eight surfaces shipped zero icons. v1.1 pairs the decision with a runtime-observable enforcement handle so the ship gate refuses on violation, not the operator's later reading of the ADR.",

package/blueprints/application-spa/contributions/adrs/adr-207-application-spa-motion.json

@@ -2,7 +2,7 @@
   "adrId": "ADR-207-application-spa-motion",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "accepted",
   "title": "Motion tokens with ease-out defaults and a reduced-motion kill switch",
   "context": "application-spa-REQ-012 requires tokenised motion. The duration range, easing family, and the reduced-motion mechanism need one recorded answer inside the SPA.",

package/blueprints/application-spa/contributions/adrs/adr-208-application-spa-i18n.json

@@ -2,7 +2,7 @@
   "adrId": "ADR-208-application-spa-i18n",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "accepted",
   "title": "String extraction and locale-aware formatting from day one, translations deferred",
   "context": "application-spa-REQ-015 requires internationalisation readiness without shipping translations. The mechanism needs one recorded answer inside the SPA.",

package/blueprints/application-spa/contributions/adrs/adr-209-application-spa-telemetry-naming.json

@@ -2,7 +2,7 @@
   "adrId": "ADR-209-application-spa-telemetry-naming",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "accepted",
   "title": "Typed journey-checkpoint events named domain.surface.action",
   "context": "application-spa-REQ-016 requires named events. Free-text names drift with refactors and kill dashboard continuity; the scheme needs one recorded answer inside the SPA.",

package/blueprints/application-spa/contributions/requirements/application-spa-req-001.json

@@ -11,8 +11,12 @@
     "blueprint:application-spa",
     "category:01-information-architecture"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-08-19T09:00:00Z",
-  "updatedAt": "2026-08-19T09:00:00Z"
+  "updatedAt": "2026-08-19T09:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-201-application-spa-app-shell",
+    "field": "responsibilities"
+  }
 }

package/blueprints/application-spa/contributions/requirements/application-spa-req-002.json

@@ -11,8 +11,12 @@
     "blueprint:application-spa",
     "category:02-navigation"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-08-19T09:00:00Z",
-  "updatedAt": "2026-08-19T09:00:00Z"
+  "updatedAt": "2026-08-19T09:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-201-application-spa-app-shell",
+    "field": "responsibilities"
+  }
 }

package/blueprints/application-spa/contributions/requirements/application-spa-req-003.json

@@ -11,8 +11,12 @@
     "blueprint:application-spa",
     "category:03-layout-system"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-08-19T09:00:00Z",
-  "updatedAt": "2026-08-19T09:00:00Z"
+  "updatedAt": "2026-08-19T09:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-201-application-spa-app-shell",
+    "field": "responsibilities"
+  }
 }

package/blueprints/application-spa/contributions/requirements/application-spa-req-004.json

@@ -11,8 +11,12 @@
     "blueprint:application-spa",
     "category:04-responsive"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-08-19T09:00:00Z",
-  "updatedAt": "2026-08-19T09:00:00Z"
+  "updatedAt": "2026-08-19T09:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-201-application-spa-app-shell",
+    "field": "purpose.every"
+  }
 }

package/blueprints/application-spa/contributions/requirements/application-spa-req-005.json

@@ -11,8 +11,12 @@
     "blueprint:application-spa",
     "category:05-theme-system"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-08-19T09:00:00Z",
-  "updatedAt": "2026-08-19T09:00:00Z"
+  "updatedAt": "2026-08-19T09:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-201-application-spa-app-shell",
+    "field": "responsibilities"
+  }
 }

package/blueprints/application-spa/contributions/requirements/application-spa-req-006.json

@@ -11,8 +11,12 @@
     "blueprint:application-spa",
     "category:06-component-library"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-08-19T09:00:00Z",
-  "updatedAt": "2026-08-19T09:00:00Z"
+  "updatedAt": "2026-08-19T09:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-201-application-spa-app-shell",
+    "field": "responsibilities"
+  }
 }

package/blueprints/application-spa/contributions/requirements/application-spa-req-007.json

@@ -11,8 +11,12 @@
     "blueprint:application-spa",
     "category:07-forms-validation"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-08-19T09:00:00Z",
-  "updatedAt": "2026-08-19T09:00:00Z"
+  "updatedAt": "2026-08-19T09:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-205-application-spa-forms-engine",
+    "field": "responsibilities.submit-level"
+  }
 }

package/blueprints/application-spa/contributions/requirements/application-spa-req-008.json

@@ -11,8 +11,12 @@
     "blueprint:application-spa",
     "category:08-journey-completeness"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-08-19T09:00:00Z",
-  "updatedAt": "2026-08-19T09:00:00Z"
+  "updatedAt": "2026-08-19T09:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-201-application-spa-app-shell",
+    "field": "responsibilities"
+  }
 }

package/blueprints/application-spa/contributions/requirements/application-spa-req-009.json

@@ -2,7 +2,7 @@
   "reqId": "application-spa-REQ-009",
   "prdId": "PRD-001",
   "title": "User arrival and auth surfaces: landing, sign-in, sign-out, expiry, recovery, onboarding, and deep-link redirects",
-  "description": "The application ships designed surfaces for: first-visit unauthenticated landing, sign-in, sign-out confirmation, session-expired, forgot-password, account-recovery, and first-run onboarding. Deep links visited while unauthenticated redirect to sign-in and return the user to the originally requested route after successful authentication.",
+  "description": "The application ships designed surfaces for: first-visit unauthenticated landing, sign-in, sign-out confirmation, session-expired, forgot-password, account-recovery, and first-run onboarding. Deep-link and post-authentication return-to behaviour is owned on TAC-201-application-spa-app-shell.responsibilities[5].",
   "category": "functional",
   "domain": "auth",
   "priority": "must",
@@ -11,8 +11,12 @@
     "blueprint:application-spa",
     "category:09-arrival-auth"
   ],
-  "version": "1.0.0",
+  "version": "1.0.2",
   "status": "approved",
   "createdAt": "2026-08-19T09:00:00Z",
-  "updatedAt": "2026-08-19T09:00:00Z"
+  "updatedAt": "2026-08-19T09:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-201-application-spa-app-shell",
+    "field": "responsibilities[5]"
+  }
 }

package/blueprints/application-spa/contributions/requirements/application-spa-req-010.json

@@ -11,8 +11,12 @@
     "blueprint:application-spa",
     "category:10-state-quartet"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-08-19T09:00:00Z",
-  "updatedAt": "2026-08-19T09:00:00Z"
+  "updatedAt": "2026-08-19T09:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-201-application-spa-app-shell",
+    "field": "responsibilities"
+  }
 }